And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?)
edit: Thanks everyone, I completely forgot about fingerprinting.
It's a privacy issue. You can use it to fingerprint a user, local IP will give you quite many bits of entropy. <https://coveryourtracks.eff.org/>
Honestly I'm not even sure if I'm surprised, but it's 2022 and we've been having this problem basically since the day WebRTC was introduced. At this point, if you care about privacy, you should probably put it in the same bag as third-party cookies and just block it entirely.
There is also WebGL whose main purpose is to provide user's videocard model to advertising companies and governemnt institutions.
It's a privacy/functionality tradeoff. But most people consider not being able to videocall or do online gaming with someone in the same building to not be acceptable.
This shows how browser developers race to push new features without proper estimation of privacy concerns.
Luckily this was somewhat fixed by using randomized Apple mDNS names instead of IPs. But as a result the browser has to support Apple DNS protocol which can potentially increase attack surface.
I would prefer to disable this feature completely by default and let the minority who needs it enable it via settings.
Settling on a different trade-off then you would like is not the same thing as doing it without consideration.
The "Apple" DNS protocol is standard DNS, over a multicast IP address, on port 5353. You can literally use plain old dig to perform mDNS lookups:
$ dig @224.0.0.251 -p 5353 +short hello.local
192.168.123.45
The DNS names WebRTC generates for this purpose are random, and known only to the signaling participants.
Zoom/Teams with people in the same office? That seems like a rather large user base
Almost all of the “sales/demo/cross company” video calls I’ve been on have been in this bucket
My understanding is Zoom only supports P2P for two person calls.
I can't quite tell from this answer if it is the default or not, but it sounds like it has to be manually enabled:
> Account owners and admins can enable one-on-one meetings to have data routed between two participants (peer-to-peer), rather than going through the cloud or server. Enabling this may improve the quality and connection of one-on-one meetings (depending on how your network prioritizes traffic) by directly sending video and audio between both parties.
https://support.zoom.us/hc/en-us/articles/360061410851-Enabl...
* Controlling Robots (formant.io)
* Security Cameras
* File Sharing
* Game Streaming/VNC
I keep a list of interesting open source WebRTC projects at https://github.com/pion/awesome-pion
I don't buy it: You have to block IPv6 as well, and that's becoming harder to do.
If the user is trying to protect their "privacy" from their ISP by using a VPN (for example), and are attempting to prevent the application-level leak of providing a list of all the local interfaces, they really need to configure their system to restrict e.g. their web browsers and other sensitive tools to those specific interfaces, e.g.
https://askubuntu.com/questions/1313755/forcing-chrome-brows...
This should be easier, like maybe a button in the VPN software.
I think an opt-in permission seems like the way to go, like the one we already have for microphone/camera permissions, and possibly just merged with these (i.e. grant WebRTC permissions together with A/V permissions).
There are quite a few interesting non-A/V WebRTC applications around – these could be handled via an explicit prompt, similarly to how newer iOS versions handle local network permissions.
That said, they don't say anything about security, I obviously forgot about fingerprinting, but still don’t see security issues?
[0] https://www.whonix.org/wiki/Data_Collection_Techniques#Finge...
I think some browser changes might have hobbled it a bit, but it was startling when I first tried it.
Anyone know an easy fix for this?
At some point it feels like trying to drain the ocean with a cup. Maybe we just need to accept that anyone who really wants to fingerprint you _can_ fingerprint you unless you use a specialist browser.
At that point the solution is fairly obvious, make it legally difficult to use unique fingerprinting and move on (ie stuff like gdpr). People will still do it, but they'll have to balance it with not falling foul of the law and wont be able to abuse it too much.
We wont stop real world facial recognition by all trying to make our faces more similar either, we have to accept it's generally possible to do, but discourage the actual doing of it rather than trying to make it impossible.
(note in both cases, actually preventing it when you have a reason to is totally possible and valid, via specialist browser modes and physical masks respectively)
I’m agreeing with you, though I wonder, is there any way to not be unique? What would you have to do? Use Windows with no extra fonts, Chrome in English, on a FullHD monitor with webgl/canvas/audio fingerprinting protection extensions?
But it’s academic for me anyway, I have Accept-Language en-US,en;q=0.7,de-DE;q=0.3 which is close enough to unique that nothing else really matters.
TBB actually adds a border at the bottom of the browser so the reported size isn't the actual size. If you change the size of your browser window to the tor-reported size then it should work.
Unless I'm misunderstanding and you mean something to do with the scrollbar?
https://coveryourtracks.eff.org/
Like siblings are saying, they use all available information to fingerprint you.
You can cover your identity only to the extent that you can display the same characteristics to the web server as the largest group of users that have all the same characteristics. This includes whether you have JS disabled as well as your IP address, User-Agent, display resolution, etc.
The normalization of mask wearing in public was a great step towards this. I really wish it had gone better. Alas!